Add Trivy security-audit workflow and report sorter; validate cgroup paths against embedded NUL

[andypost]

Motivation

• Add an automated Trivy filesystem vulnerability audit that produces a human-readable, severity-sorted Markdown report and can fail the run on configurable severity.
• Harden cgroup path validation to reject empty values and embedded NUL bytes that could lead to truncated C-string usage.
• Capture findings and follow-up items for the new audit flow in documentation and exercise the new validation with a unit test.

Description

• Add .github/scripts/sort-trivy-results.py which parses Trivy JSON output, sorts vulnerabilities by severity and CVSS v3 score, renders a Markdown report, and can exit non-zero when a configured severity threshold is met.
• Add .github/workflows/security-audit.yml GitHub Action to run Trivy (JSON and SARIF), upload SARIF, generate the sorted Markdown report, append it to the step summary, and upload the security-audit/ artifact.
• Add docs/security-audit-findings.md documenting candidate findings from a manual review of the new audit/workflow and adjacent code paths.
• Harden C validation in src/nxt_conf_validation.c for cgroup paths by rejecting empty strings and embedded NUL bytes, replacing a sprintf with snprintf to avoid unsafe formatting, and preserving the existing ".." path check.
• Extend test/test_python_isolation.py to include a test case that asserts a cgroup path containing an embedded NUL ('scope\0python') is treated as invalid.

Testing

• Updated isolation unit test test/test_python_isolation.py::test_python_isolation_cgroup_invalid was run and the new case for embedded NULs passed.
• The repository unit test suite was executed after the change via the project test runner and completed successfully.
• The new GitHub Actions workflow was added and its configuration validated via static review; the workflow will run in CI on pushes, PRs, and a weekly schedule.

---

Codex Task

[gemini-code-assist]

Code Review

This pull request adds a Python script to generate severity-sorted Markdown reports from Trivy JSON output and includes a new document tracking potential security vulnerabilities. Additionally, it hardens cgroup path validation in src/nxt_conf_validation.c by rejecting embedded NUL bytes and using snprintf, with a corresponding test case added. Review feedback suggests enhancing the Markdown escaping logic to handle backslashes and removing redundant severity normalization in the sorting process.

[andypost]

Reworked. The C-hardening half of this draft (cgroup/rootfs embedded-NUL + sprintf(%*s) → snprintf(%.*s)) has been rebased onto current pre-1.35.6, extended with a rootfs config-time validator, verified against a live unitd, and opened as freeunitorg/freeunit#95.

Deliberately not carried over:

• Trivy workflow + sort-trivy-results.py → moved to a separate ci: PR (freeunitorg/freeunit#99).
• docs/security-audit-findings.md → a public list of suspected-unfixed vulns; kept out of the repo for disclosure hygiene. Its one live item (rootfs NUL / SA-001) is fixed by freeunitorg/freeunit#95; the rest folded into the private wave-2 tracker.

This draft can be closed once both land.

[andypost]

The Trivy half is now reworked as freeunitorg/freeunit#99 (report-only by default, security-events:write scoped to the job, docs/security-audit-findings.md dropped for disclosure hygiene).

With the C validation fix in freeunitorg/freeunit#95 and the workflow in freeunitorg/freeunit#99, this draft is fully superseded and can be closed once both land.